PT-2025-54828 · Apache · Apache Tomcat

Published 2025-01-01 · Updated 2026-03-23 · CVE-2025-66614

Positive Technologies · (AI Summary)

CVSS v3.1

9.1

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.14 Apache Tomcat versions 10.1.0-M1 through 10.1.49 Apache Tomcat versions 9.0.0-M1 through 9.0.112 Apache Tomcat versions 8.5.0 through 8.5.100

Description Tomcat did not properly validate the host name provided through the Server Name Indication (SNI) extension against the host name in the HTTP host header field. This issue arises when Tomcat is configured with multiple virtual hosts, where TLS configurations differ – specifically, when one host requires client certificate authentication while another does not. A client could potentially bypass client certificate authentication by sending mismatched host names in the SNI extension and the HTTP host header. The issue is only relevant when client certificate authentication is enforced solely at the Connector level and does not apply if enforced within the web application.

Recommendations Apache Tomcat versions 11.0.0-M1 through 11.0.14: Upgrade to version 11.0.15 or later. Apache Tomcat versions 10.1.0-M1 through 10.1.49: Upgrade to version 10.1.50 or later. Apache Tomcat versions 9.0.0-M1 through 9.0.112: Upgrade to version 9.0.113 or later. Apache Tomcat versions 8.5.0 through 8.5.100: Upgrade to a more recent version.

Fix

Improper Certificate Validation

RCE

Weakness Enumeration

CWE-295

CWE-20

Related Identifiers

BIT-TOMCAT-2025-66614

CVE-2025-66614

GHSA-FPJ8-GQ4V-P354

MGASA-2026-0056

OPENSUSE-SU-2026:10305-1

OPENSUSE-SU-2026:10306-1

OPENSUSE-SU-2026:10307-1

OPENSUSE-SU-2026:20350-1

SUSE-SU-2026:0877-1

SUSE-SU-2026:0890-1

SUSE-SU-2026:0932-1

Affected Products

Apache Tomcat

References · 59

• https://osv.dev/vulnerability/UBUNTU-CVE-2025-66614 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66614 · Security Note
• https://lists.apache.org/thread/vw6lxtlh2qbqwpb61wd3sv1flm2nttw7 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-66614 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10305-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2026-0056 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0890-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-66614 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10307-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0877-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0932-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tomcat-2025-66614 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fpj8-gq4v-p354 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66614 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20350-1 · Vendor Advisory